CVE-2026-70588

Received Received - Intake

Universal Import XSS in Ghost CMS

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-70588

Affected Vendors & Products

Vendor	Product	Version / Range
ghost	ghost	to 6.54.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in Ghost, a Node.js content management system. It affects versions from 5.26.0 to 6.54.0. The Universal Import feature in Ghost Admin did not properly sanitize imported content, allowing malicious scripts to be executed in post content.

Impact Analysis

An attacker could exploit this to inject malicious scripts into posts. This could lead to unauthorized actions on behalf of users, data theft, or defacement of content. Users with access to the admin panel are most at risk.

Compliance Impact

This XSS vulnerability could compromise data integrity and confidentiality, potentially violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face compliance violations if user data is exposed or altered due to the exploit.

Mitigation Strategies

Update Ghost to version 6.54.1 or later to fix the Universal Import XSS vulnerability.

Hi! I’m here to help you understand CVE-2026-70588. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70